← Home

Privacy Notice

Last updated: June 2026

About Boris's analysis

Boris is an advice service that bundles and learns from best-known practices and shares feedback on the cases you submit. Boris's verdict is never final or decisive — it is a suggestion and best current understanding, not a guarantee. Boris can make mistakes, and you remain responsible for judging and acting on its output. See our Terms & Conditions for the full disclaimer.

1. Who we are

Boris is operated by underdogdesign ("we", "us"). We act as the data controller for personal data processed through this service. Contact us at the support address shown in the app.

2. Personal data we collect

  • Account data: email address, display name, login credentials.
  • Content you submit: text, links, images, audio and files you send to Boris for analysis.
  • Usage data: scans performed, timestamps, verdicts, device and browser information, IP address.
  • Email forwarding data (Pro): messages you forward to your personal Boris address.
  • Billing data: handled by Stripe; we receive subscription status, plan, and customer identifiers, not full card details.

3. Purposes & legal basis

  • Provide the service and analyse content you submit — performance of contract.
  • Account creation, authentication and customer support — performance of contract.
  • Security, fraud and abuse prevention — legitimate interests.
  • Product improvement and aggregated analytics — legitimate interests.
  • Compliance with legal obligations — legal obligation.

4. Data sharing

We share personal data only with:
  • Service providers / subprocessors: hosting, database, email delivery, AI analysis providers, analytics.
  • Stripe, Inc. — our payment processor and, where applicable, Merchant of Record. Stripe handles checkout, payments, tax, invoicing, subscription management and refunds, and is an independent controller for the data it collects at checkout. See stripe.com/privacy.
  • Professional advisers (legal, accounting) where strictly necessary.
  • Authorities where required by law.

5. International transfers

Some of our providers are located outside the EEA/UK. Where this is the case, transfers are protected by appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

6. Retention

We keep account data for as long as your account is active and for a reasonable period after closure to handle disputes and meet legal obligations. Submitted scan content is kept only as long as needed to provide and improve the service, and then deleted or anonymised.

7. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. EEA/UK users also have the right to complain to a supervisory authority. We respond within one month.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls and least-privilege practices, to protect your data.

9. Cookies

We use cookies and similar technologies that are strictly necessary to operate the service (e.g. authentication). Where we use optional analytics or marketing cookies, you can manage your preferences in your browser.

10. Changes

We may update this notice from time to time. Material changes will be communicated through the service.

11. Children

The Service is not intended for children. You must be at least 16 years old (or the minimum age of digital consent in your country) to create an account. If we learn that we hold personal data of a child below that age without a valid legal basis, we delete it.

12. Automated processing — no decisions with legal effect

Boris analyses your submissions automatically, including with large language models. These analyses are advisory suggestions only; we do not use them to take decisions about you that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. You can always ask a human at our support address to review an outcome.

13. International users and local privacy rights

  • EEA / UK / Switzerland: we act as controller and rely on the legal bases in section 3; you may complain to your local supervisory authority.
  • California and other US states: we do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information for inferring characteristics. You may request access, correction, deletion and portability, and you will not be discriminated against for exercising those rights.
  • Canada, Australia and other regions: equivalent access, correction and complaint rights apply under local law (PIPEDA, Australian Privacy Principles and comparable regimes).
Contact us at the support address in the app to exercise any right; we may need to verify your identity first.

14. Data breaches

We maintain procedures to detect, investigate and respond to personal data breaches, and we notify the competent supervisory authority and affected users where the applicable law requires it.

15. Contact and complaints

Questions, requests or complaints about privacy can be sent to the support address shown in the app. We are not required to appoint a Data Protection Officer, but privacy requests are handled by the person responsible for data protection at underdogdesign.